CVE-2002-1157

None

CVSS

—

EPSS

11.1%

Published

Nov 4, 2002

CISA due date

—

The record

Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.

Affected packages

Ecosystem	Package	Introduced	Fixed
Debian:3.0	libapache-mod-ssl	0	2.8.9-2.1

Related vulnerabilities

CVE-2005-2700 ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in… Also affects libapache-mod-ssl
CVE-2004-0488 Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for… Also affects libapache-mod-ssl